Disabling self creating account capability in external tenant

Yes—this remains true for a Microsoft Entra External ID external tenant: disabling registration for an existing sign-up/sign-in user flow is done through Microsoft Graph, while self-service password reset (SSPR) can be enabled separately in the Microsoft Entra admin center.

Disable new account creation

Setting onInteractiveAuthFlowStart.isSignUpAllowed to false prevents new registrations but permits users already present in the external tenant to sign in. There is currently no corresponding disable-sign-up toggle in the admin center. ^1^

1. In the admin center, switch to the external tenant.
2. Go to Entra ID → External Identities → User flows.
3. Select the relevant flow, then select Applications under Use.
4. Copy the application's Application (client) ID.
5. Open Microsoft Graph Explorer, sign in using an account in that external tenant, and consent to:
   • EventListener.Read.All to retrieve the flow.
   • EventListener.ReadWrite.All to update it.
6. Use the application-specific request in Example 4: List user flow associated with specific application ID to retrieve the associated flow ID, rather than selecting a flow by display name. ^2^
7. Replace {user-flow-id} below and run the request:

PATCH https://graph.microsoft.com/v1.0/identity/authenticationEventsFlows/{user-flow-id}
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.externalUsersSelfServiceSignUpEventsFlow",
  "onInteractiveAuthFlowStart": {
    "@odata.type": "#microsoft.graph.onInteractiveAuthFlowStartExternalUsersSelfServiceSignUp",
    "isSignUpAllowed": false
  }
}

The current Graph API reference supports this operation on v1.0; success returns 204 No Content. The least-privileged permission for the update is EventListener.ReadWrite.All. For delegated access, External ID User Flow Administrator is the least-privileged supported Entra role. ^3^

Microsoft’s dedicated External ID procedure still illustrates the PATCH using the /beta endpoint, but the current API reference documents the update operation on v1.0. ^1^

Preserve password reset

For local accounts using Email with password, SSPR is configured independently and can remain available when sign-up is disabled.

The administrator configuring SSPR needs at least the Security Administrator role. Then:

1. Go to Entra ID → External Identities → User flows.
2. Select the flow and verify that Email with password is registered under Identity providers.
3. Go to Entra ID → Authentication methods → Policies.
4. Select Email OTP, turn it on, target All users or selected groups, and select Save.
5. To show the reset link, search for Company Branding.
6. Under Default sign-in, select Edit → Sign-in form.
7. Under Self-service password reset, select Show self-service password reset.
8. Select Review + save, then Save. ^4^

Email/password users can then select Forgot password?, verify themselves using an enabled method such as Email OTP, and choose a new password. ^5^

Important identity-provider limitation

If the flow includes Google, Facebook, or a custom OIDC provider, disabling sign-up also prevents External ID from automatically creating a first-time federated user. Such users must already exist in the external tenant before signing in; this setting cannot block only local registration while retaining just-in-time federated account creation. ^6^

End-to-end validation

Test the flow in a private browser session:

• An existing email/password account can sign in.
• That account can complete Forgot password? and sign in with the new password.
• A previously unused email address cannot create an account.
• If federated providers are configured, a first-time federated identity is rejected unless its account was provisioned beforehand.

References

1. Disable sign-up in a sign-up and sign-in user flow
2. List authenticationEventsFlows
3. Update authenticationEventsFlow
4. Enable self-service password reset
5. Identity providers for external tenants
6. Entra External ID - Disable Local Signup while supporting Custom Identity Provider user creation - Microsoft Q&A